7

I'm using Spring Security 3.0.0 and persistent RememberMe. When the server restarts and a browser window is still open, we need to be able to continue using the application without having to login - if remember me is selected.

I'm getting a org.springframework.security.web.authentication.rememberme.CookieTheftException: Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack, when I try to continue to use the application after a server restart. What I notice is that the processAutoLoginCookie method gets called twice. I'm not sure why. The behavior of the method itself seems to be correct, ie , update the token in the database and update the cookie in the client.

Any help on this would be appreciated.

Thank you.

3
  • Have you found answer to this problem?
    – mmatloka
    Commented Dec 23, 2011 at 16:06
  • 1
    This happened a long ago and I forget the details. But in short this was the problem -- In my particular case it was because we were using Comet for long polling. So the processAutoLoginCookie method was called once by the long polling and from regular page load. So, before the first response was received the cookie had changed in the database. Again, I forget the exact details but this was it in a nutshell.
    – smk
    Commented Feb 23, 2012 at 19:54
  • I have posted a similar question but I answered it on my own =). The solution I have can be found here--> http://stackoverflow.com/questions/13393774/invalid-remember-me-token-series-token-mismatch-implies-previous-cookie-theft/13402874#13402874
    – Warner
    Commented Nov 15, 2012 at 17:28

1 Answer 1

1

I was getting the exact same issue! The processAutoLoginCookie was getting called twice in succession so that the first call was successful, but the second call fails because the cookie is updated by the first call.

My only solution was to subclass PersistentTokenBasedRememberMeServices and override the processAutoLoginCookie method. I had to copy the existing code for processAutoLoginCookie and comment out the throwing of the CookieTheftException.

Note: My solution will open up a security hole!

If you are happy to allow for Cookie Thefts to occur (my system is used internally and does not contain sensitive data) then this solution will work.

Alternatively, you could also subclass PersistentTokenBasedRememberMeServices and add a more robust solution that still checks for Cookie Theft Exceptions but allows the two successive calls to processAutoLoginCookie to be made.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.